io.github.davidmosiah/strava-mcp

NPM · STRAVA-MCP-UNOFFICIAL · SCANNED AUG 3

Privacy-first MCP server for Strava activities, streams, routes and training.

Available components

+18 this week 69 69 Trust /100

Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →

Supply Chain Security87

No malware found by supply-chain analysis.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree.Partial
No install/post-install scripts declared.Pass
Only part of the dependency tree could be resolved (129 of 130), so this covers what we could see, not the whole tree. View diagnostics → Partial

Provenance & Transparency45

Source repository is publicly reachable at the declared URL. View diagnostics → Pass
Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
Clear OSI-approved license (MIT).Pass
Actively maintained (last published 1 days ago).Pass
Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail

Schema Quality & AI Usability82

100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
AI-judged instruction clarity (good).Pass
Tool/resource definitions use about 2579 tokens (~73/item across 35 items; 28 tools + 7 resources), lean.Pass
Usage-examples check failed: none of the tools include examples. See how to fix → Fail

Stability & Change Management27

Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial

Tool Coverage89

100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
60% of tool parameters carry a description.Partial
Structured output schemas are declared (82% of tools); any adoption earns full credit.Pass

Capabilities100

Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass

Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

npm · strava-mcp-unofficial

Claude Codex opencode OpenClaw Hermes Other

# add to Claude Code

claude mcp add davidmosiah-strava-mcp -- npx -y strava-mcp-unofficial

# add to Codex CLI

codex mcp add davidmosiah-strava-mcp -- npx -y strava-mcp-unofficial

// opencode.json

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "davidmosiah-strava-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "strava-mcp-unofficial"
      ],
      "enabled": true
    }
  }
}

# add to OpenClaw

openclaw mcp add davidmosiah-strava-mcp --command npx --arg -y --arg strava-mcp-unofficial

# ~/.hermes/config.yaml

mcp_servers:
  davidmosiah-strava-mcp:
    command: "npx"
    args: ["-y", "strava-mcp-unofficial"]

// mcp.json

{
  "mcpServers": {
    "davidmosiah-strava-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "strava-mcp-unofficial"
      ]
    }
  }
}

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

2 Aug 26 +44
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- License: unverified → pass ▲ functional
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.23 ▲ functional
- Schema quality: unverified → good ▲ functional
- Licence: MIT functional
31 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
30 Jul 26 −26
- Tool coverage: 100 → unverified ▼ functional
- Schema quality: 100 → unverified ▼ functional
- Dependency health: unverified → partial ▲ functional
27 Jul 26 51

First indexed and scored.

Show 3 earlier entries Hide earlier entries

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Analysed npm/[email protected]

Provenance none

Ecosystem: npm · Outcome: none

Dependencies 129 packages

129 packages in the resolved dependency tree · 129 deprecated · 49 stale.

The dependency tree was only partially resolved, so these counts may be incomplete.

MCP tools — 28 exposed · ~2,435 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens

strava_agent_manifest Strava Agent Manifest ~59

Machine-readable install, runtime and client guidance for AI agents. Includes Hermes direct tool names and anti-gateway-restart guidance. Does not call Strava or expose secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
agent_rules	array	yes	—
client	string	yes	—
hermes	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
oauth	object	yes	—
package	object	yes	—
project	string	yes	—
recommended_first_calls	array	yes	—
resources	array	yes	—
standard_tools	array	yes	—
troubleshooting	array	yes	—
unofficial	boolean	yes	—

No examples provided.

strava_cache_status Strava Cache Status ~38

Show optional local SQLite cache status. Enable with STRAVA_CACHE=sqlite or STRAVA_CACHE=true.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
enabled	boolean	yes	—
entries	integer	yes	—
http_cache	object	—	—
newest_cached_at	string	—	—
path	string	yes	—

No examples provided.

strava_capabilities Strava MCP Capabilities ~46

Explain supported Strava data, privacy boundaries, GPS handling, recommended agent workflow and project links. Does not call Strava or expose secrets.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	object	yes	—
auth_model	object	yes	—
client_aliases	object	yes	—
contribution_paths	array	yes	—
creator	object	yes	—
links	object	yes	—
mcp_name	string	yes	—
privacy_modes	array	yes	—
project	string	yes	—
recommended_agent_flow	array	yes	—
supported_data	array	yes	—
unofficial	boolean	yes	—

No examples provided.

strava_connection_status Strava Connection Status ~55

Check local Strava config, token file, Node version, privacy mode, cache readiness and optional MCP client readiness without calling Strava or exposing secrets.

Input Output Examples

Name	Type	Req	Description
client	string	—	—
response_format	string	—	—

Name	Type	Req	Description
automatic_auth_supported	boolean	yes	—
cache	object	yes	—
client	string	—	—
client_checks	object	—	—
config	object	yes	—
effective_status	string	yes	—
missing_env	array	yes	—
next_steps	array	yes	—
node	object	yes	—
oauth	object	yes	—
ok	boolean	yes	—
privacy_mode	string	yes	—
ready_for_strava_api	boolean	yes	—
redirect_uri	string	—	—
required_env	object	yes	—
token	object	yes	—

No examples provided.

strava_daily_summary Strava Daily Training Summary ~74

Build a practical daily training/load summary from recent Strava activities. Read-only and non-medical.

Input Output Examples

Name	Type	Req	Description
days	integer	—	Lookback window for recent training context.
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

strava_data_inventory Strava Data Inventory ~47

Inventory supported Strava data domains, auth scope requirements, privacy boundary and recommended first calls. Does not call Strava APIs or expose user data.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
api_boundary	—	—	—
auth	—	—	—
categories	array	yes	—
data_access_model	string	yes	—
first_tools	array	yes	—
generated_at	string	yes	—
kind	string	yes	—
links	object	yes	—
mcp_name	string	yes	—
notes	array	yes	—
privacy_modes	array	yes	—
recommended_agent_flow	array	yes	—
scopes	array	yes	—
source	string	yes	—
totals	object	yes	—
unofficial	boolean	yes	—

No examples provided.

strava_demo Strava Demo ~51

Returns realistic example payloads of strava_daily_summary, strava_training_context, and strava_list_activities so agents see the contract before calling real Strava APIs.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

strava_exchange_code Exchange Strava OAuth Code ~63

Exchange a Strava OAuth authorization code for local tokens. Tokens are stored locally with 0600 permissions and are never returned.

Input Output Examples

Name	Type	Req	Description
code	string	yes	OAuth authorization code, or a full redirect URL containing ?code=...
response_format	string	—	—

Name	Type	Req	Description
expires_at	number	—	—
note	string	yes	—
ok	boolean	yes	—
scope	string	—	—
token_path	string	yes	—

No examples provided.

strava_get_activity Strava Activity ~79

Get detailed activity data by id. Summary/structured modes protect raw GPS details.

Input Output Examples

Name	Type	Req	Description
id	—	yes	Strava resource id.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_activity_streams Get Activity Streams ~163

Get Strava activity streams such as time, distance, heartrate, cadence, watts and altitude. GPS latlng is withheld unless include_gps=true or privacy_mode=raw.

Input Output Examples

Name	Type	Req	Description
id	—	yes	Strava activity id.
include_gps	boolean	—	Allow latlng stream in structured output. Raw mode always returns requested upstream payload.
keys	array	—	Stream keys to request. latlng is withheld unless privacy_mode=raw or include_gps=true.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
resolution	string	—	Optional Strava stream resolution.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_activity_zones Strava Activity Zones ~77

Get heart-rate/power zones for an activity when available.

Input Output Examples

Name	Type	Req	Description
id	—	yes	Strava resource id.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_athlete Get Authenticated Athlete ~73

Get the authenticated Strava athlete profile. Requires read/profile scope depending on requested fields.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_athlete_stats Get Athlete Stats ~69

Get public-visible aggregate Strava stats for the authenticated athlete.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_auth_url Get Strava OAuth URL ~73

Generate a Strava OAuth authorization URL. Use this first when no local token exists.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—
scopes	array	—	Optional scope override. Defaults to read-only Strava scopes used by this server.
state	string	—	Optional OAuth state value generated by the caller.

Name	Type	Req	Description
auth_url	string	yes	—
next_step	string	yes	—
redirect_uri	string	yes	—
scopes	array	yes	—

No examples provided.

strava_get_gear Strava Gear ~72

Get gear/equipment details by id.

Input Output Examples

Name	Type	Req	Description
id	—	yes	Strava resource id.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_route Strava Route ~78

Get route details by id. Summary/structured modes avoid full route geometry.

Input Output Examples

Name	Type	Req	Description
id	—	yes	Strava resource id.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_get_zones Get Athlete Zones ~67

Get the authenticated athlete heart-rate and power zones when available.

Input Output Examples

Name	Type	Req	Description
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
data	—	yes	—
endpoint	string	yes	—
privacy_mode	string	yes	—

No examples provided.

strava_list_activities Strava Activities ~183

List authenticated athlete activities. Supports after/before filters and Strava pagination. Requires activity:read or activity:read_all.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return activities after this time. Converted to Strava epoch seconds.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return activities before this time. Converted to Strava epoch seconds.
limit	integer	—	Strava per_page value. Strava allows up to 200.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Strava page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

strava_list_clubs Strava Clubs ~166

List clubs joined by the authenticated athlete.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return activities after this time. Converted to Strava epoch seconds.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return activities before this time. Converted to Strava epoch seconds.
limit	integer	—	Strava per_page value. Strava allows up to 200.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Strava page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

strava_list_routes Strava Routes ~174

List authenticated athlete routes. GPS/map geometry is redacted unless raw mode is requested.

Input Output Examples

Name	Type	Req	Description
after	string	—	Only return activities after this time. Converted to Strava epoch seconds.
all_pages	boolean	—	Fetch multiple pages up to max_pages.
before	string	—	Only return activities before this time. Converted to Strava epoch seconds.
limit	integer	—	Strava per_page value. Strava allows up to 200.
max_pages	integer	—	Maximum pages to fetch when all_pages is true.
page	integer	—	Strava page number.
privacy_mode	string	—	Optional per-call privacy override. Defaults to STRAVA_PRIVACY_MODE or structured. raw returns upstream Strava JSON. summary removes GPS/map details.
response_format	string	—	—

Name	Type	Req	Description
count	integer	yes	—
endpoint	string	yes	—
has_more	boolean	yes	—
next_page	integer	—	—
pages_fetched	integer	yes	—
privacy_mode	string	yes	—
records	array	yes	—

No examples provided.

strava_onboarding Wellness Onboarding Flow ~116

Read-only. Return the 11-question Delx Wellness onboarding flow (en or pt-BR), the current shared profile, missing critical fields, and a cross-connector hint. Use this when the user starts a fresh wellness session and you need to fill out preferred_name, goals, devices, training context, nutrition, preferences, and safety. Strava continues to redact GPS by default — onboarding does not change that.

Input Output Examples

Name	Type	Req	Description
locale	string	—	Onboarding locale. Defaults to en.
response_format	string	—	—

No output schema declared.

No examples provided.

strava_privacy_audit Strava Privacy Audit ~42

Return local privacy, cache, token-path, GPS redaction and env-presence posture without revealing secret values.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
cache_enabled	boolean	yes	—
cache_path	string	yes	—
config_source	string	yes	—
gps_redaction_default	boolean	yes	—
local_config_exists	boolean	yes	—
local_config_path	string	yes	—
local_config_secure_permissions	boolean	—	—
notes	array	yes	—
privacy_mode_default	string	yes	—
project	string	yes	—
raw_payloads_opt_in	boolean	yes	—
redacted_key_patterns	array	yes	—
required_env_present	object	yes	—
secret_env_vars	array	yes	—
stdout_safe	boolean	yes	—
token_path	string	yes	—
unofficial	boolean	yes	—

No examples provided.

strava_profile_get Get Shared Wellness Profile ~109

Read the canonical Delx Wellness profile shared with the other wellness MCP connectors (Nourish, Cycle Coach, CGM, etc.). Read-only. Profile stores only what the user typed during onboarding — never OAuth tokens, API keys, or biomarkers. Note: this profile does NOT change Strava's GPS-redaction default; Strava continues to redact latlng and route geometry unless STRAVA_GPS_INCLUDE=true or include_gps=true is explicitly passed.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

strava_profile_update Update Shared Wellness Profile ~143

Persist a partial patch to the canonical Delx Wellness profile. Requires explicit_user_intent=true after the user confirms they want to save. Rejects secret-like fields (oauth, token, api_key, password, cookie, refresh, session). Strava's GPS-redaction default is unaffected by profile changes.

Input Output Examples

Name	Type	Req	Description
explicit_user_intent	boolean	—	Set to true ONLY after the user has explicitly confirmed they want to save this. Otherwise the tool refuses to write.
patch	object	yes	Partial WellnessProfileDocument patch. Top-level keys: profile, goals, devices, training, nutrition, preferences, safety, notes.
response_format	string	—	—

No output schema declared.

No examples provided.

strava_quickstart Strava Quickstart ~63

Personalized 3-step setup walkthrough for the human user. Adapts to current state (env vars set? token present? what's next?). Call this first when the user asks 'how do I connect Strava?'

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

No output schema declared.

No examples provided.

strava_revoke_access Revoke Strava OAuth Access ~47

Revoke the current Strava OAuth access grant and delete the local token file. Use only when the user explicitly wants to disconnect Strava.

Input Output Examples

Name	Type	Req	Description
response_format	string	—	—

Name	Type	Req	Description
local_tokens_cleared	boolean	yes	—
note	string	yes	—
ok	boolean	yes	—
token_path	string	yes	—

No examples provided.

strava_training_context Strava Training Context ~105

Normalize recent Strava activity load into a compact training_context for workout recommendation engines. Includes fallback guidance when recent Strava activity is missing.

Input Output Examples

Name	Type	Req	Description
days	integer	—	Lookback window for normalized Strava training context.
injury_flags	array	—	—
notes	string	—	—
response_format	string	—	—
soreness	array	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
context_contract_version	string	yes	—
context_type	string	yes	—
data_quality	—	—	—
fallback_hint	string	—	—
generated_at	string	yes	—
injury_flags	array	yes	—
last_activity_type	—	—	—
notes	array	—	—
privacy	object	yes	—
recent_training_load	string	yes	—
recommended_handoff	object	yes	—
relative_effort	number	—	—
soreness	array	yes	—
soreness_hint	number	—	—
source	string	yes	—
telegram_summary	string	—	—
weekly_minutes	number	—	—

No examples provided.

strava_weekly_summary Strava Weekly Training Review ~103

Build a weekly Strava scorecard with volume, intensity, sport mix, bottlenecks and next-week actions. Read-only and non-medical.

Input Output Examples

Name	Type	Req	Description
compare_days	integer	—	Prior comparison window in days. Use 0 to disable comparison.
days	integer	—	Recent analysis window in days.
response_format	string	—	—
timezone	string	—	IANA timezone used only for display, e.g. America/New_York.

Name	Type	Req	Description
generated_at	string	yes	—
kind	string	yes	—

No examples provided.

On this page

Handy links

Scoring key

80+ high trust
60–79 medium
below 60 low

How we score

Score history · last 30 days

27 Jul 3 Aug